Security status and information display system

ABSTRACT

The present invention provides a system and method for reporting security information relating to a mobile device. The invention enables a security assessment to be displayed in various formats on the mobile device display or on a client computer. A security component identifies security events on the mobile device that are processed on the mobile device or by a server. The security component then determines a security assessment for the mobile device based upon the detected security events. The security assessment display may be persistent in the form of a desktop widget or dashboard on a client computer, or home-screen item on the mobile device. This allows a user or administrator to verify that security protection on the device is functioning and to be alerted if the device needs attention without having to specifically seek the information, thereby enabling immediate response to potential security problems.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is related to the following co-pending U.S.patent applications: U.S. application Ser. No. 12/255,632, filed Oct.21, 2008, “SECURE MOBILE PLATFORM SYSTEM,” U.S. application Ser. No.12/255,626, filed Oct. 21, 2008, “SYSTEM AND METHOD FOR A MOBILECROSS-PLATFORM SOFTWARE SYSTEM,” U.S. patent application Ser. No.12/255,621, filed Oct. 21, 2008, “SYSTEM AND METHOD FOR ATTACK ANDMALWARE PREVENTION,” and U.S. patent application Ser. No. 12/255,614,filed Oct. 21, 2008, “SYSTEM AND METHOD FOR MONITORING AND ANALYZINGMULTIPLE INTERFACES AND MULTIPLE PROTOCOLS” which are all herebyincorporated by reference.

FIELD

The present invention relates generally to methods and systems forproviding security status information for display on a mobile device, oron other computers monitoring activity on the mobile device.

BACKGROUND

Mobile devices such as cell phones and personal digital assistants(PDAs) can be attacked by exploits or viruses that are specificallyadapted for the mobile environment. Exploits can take advantage ofsecurity vulnerabilities associated with a mobile device in order toexecute malicious code or perform undesired actions on the device.Potentially, exploits can bypass permissions or policies set by theuser, manufacturer, operating system, or mobile operator and give theattacker complete control of the device. Mobile viruses are typicallyspread by downloading infected programs or files. Some viruses onlybecome active if the recipient chooses to accept the virus file and runit on the mobile device. Other viruses, when combined with exploits, areself-propagating worms that may not need user intervention in order tospread, potentially creating a very severe and widespread securityproblem.

Devices may be compromised by viruses and exploits over wide areanetworks, such as the Internet or a cellular network, and local wirelessnetworks, such as Wi-Fi or Bluetooth. For example, some devices whichare equipped with Bluetooth allow other nearby Bluetooth-enabled devicesto transfer files or other data such as contact information.Bluetooth-enabled devices that are infected with viruses often searchfor nearby devices that are in “discoverable” mode. When an infecteddevice discovers a target, it may send a virus disguised as a securityupdate or another item designed to fool the target device's user intoaccepting the transfer and executing the virus. If a virus were toutilize an exploit instead of disguising itself in order to get a targetuser to accept the file transfer, a device which is in “discoverable”mode could become infected without the user being able to intervene.

In addition to being able to propagate viruses, exploits may be able todirectly perform malicious actions on vulnerable devices. Such exploitsmay be used by attackers to steal information, charge money to thetarget device's phone bill, or prevent a device from functioningproperly. Although vulnerabilities which take advantage of exploits maybe fixed if the software vendor responsible for the vulnerabilityprovides a patch or firmware upgrade, such fixes are often costly andtime consuming to release and difficult for users or IT organizations toapply.

It is important that both individual users and IT organization be ableto verify that their security protection is functioning properly and beaware of the security state of their devices so as to be able toremediate or investigate issues as early as possible. If a device orgroup of devices has a security problem or has recently been attacked,the user or administrator responsible may not immediately know becausemobile devices and existing solutions may not continuously presentsecurity status information and attempt to push important events tousers and administrators.

What is needed is a system and method for identifying, reporting, andpreventing mobile security problems and for providing securityinformation concerning the state of a mobile device or group of mobiledevices to a user or administrator. The system and method should keepusers or administrators continuously aware of security status, recentsecurity-related events, and potential security threats withoutrequiring them to repeatedly seek out security-related information.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example and notlimitation in the figures of the accompanying drawings, in which likereferences indicate similar elements, and in which:

FIG. 1 is an exemplary block diagram depicting an embodiment of a mobiledevice which detects and processes security events;

FIG. 2 is an exemplary flow chart illustrating the processing ofsecurity events on a mobile device;

FIG. 3 is an exemplary block diagram depicting an embodiment of thepresent invention in which security events detected by a mobile deviceare processed on a remote server;

FIG. 4 is an exemplary flow diagram illustrating the processing ofsecurity events on a server;

FIG. 5 is an exemplary home screen graphical user interface for themobile device;

FIG. 6 is an exemplary security screen graphical user interface for themobile device;

FIG. 7 is an exemplary web based mobile device security status display;and

FIG. 8 is an exemplary e-mail summary of the mobile device securitystatus.

FIG. 9 is an exemplary messaging diagram illustrating the flow ofcommunications according to an embodiment of the present invention.

DETAILED DESCRIPTION

It should be appreciated that the present invention can be implementedin numerous ways, including as a process, an apparatus, a system, adevice, a method, or a computer readable medium such as a computerreadable storage medium comprising computer program instructions or acomputer network wherein computer program instructions are sent overoptical or electronic communication links. Applications, softwareprograms or computer readable instructions may be referred to ascomponents or modules. Applications may take the form of softwareexecuting on a general purpose computer or be hardwired or hard coded inhardware. In this specification, these implementations, or any otherform that the invention may take, may be referred to as techniques. Ingeneral, the order of the steps of disclosed processes may be alteredwithin the scope of the invention.

The present invention is directed towards a system that displays thesecurity status and security event information for a mobile devicerunning security software. In an embodiment, the mobile device has asecurity system that runs on the mobile device which analyzes networkdata and files for security threats and determines the security state ofthe mobile device. The security system produces graphical displaysindicating the security state of the mobile device and detailing thesecurity events that have been detected and processed. In thisembodiment, the mobile device may obtain periodic updates of mobilevirus information from a server. The mobile device may also send thesecurity information to a server for display on a computer to permitmonitoring of security information relating to the mobile device.

With reference to FIG. 1, a block diagram of an embodiment of the mobiledevice 101 is illustrated. The mobile device 101 can include: anoperating system 113, an input device 115, a radio frequencytransceiver(s) 117, a visual display 121, database of security eventinformation 123, and a battery or power supply 119. Each of thesecomponents can be coupled to a central processing unit (CPU) 103. Theoperating system 113 runs on the CPU 103 and provides an interfacebetween security system application programs and the mobile devicehardware.

The inventive system can receive data through an RF transceiver(s) 115which may be able to communicate with various other electronic devices.The RF transceiver(s) 115 can transmit and receive data over variousnetworks, for example: Bluetooth, local area networks such as Wi-Fi, andcellular networks such as GSM or CDMA. The RF transceiver(s) 115 cantransmit and receive various types of data including voice, text,photos, video, SMS messages, applications, etc. All forms of datapackets can be analyzed and processed by the inventive system.Additional details about the analysis and processing of data isdescribed in U.S. application Ser. No. 12/255,614, filed Oct. 21, 2008,“System and Method for Monitoring and Analyzing Multiple Interfaces AndMultiple Protocols.”

In an embodiment, a local security component 105, an informationgathering component 107 and a transport component 109, can beapplication programs that are downloaded and integrated with the mobiledevice operating system 113. Much of the source code for these securitycomponents can be re-used between various mobile device platforms byusing a cross-platform software architecture. The local securitycomponent 105, an information gathering component 107 and a transportcomponent 109 provide specific security status information which caninclude an overall security state and security event information.Additional details of the mobile platform system and the processingperformed by the security components are disclosed in U.S. patentapplication Ser. No. 12/255,632, filed Oct. 21, 2008, “Secure MobilePlatform System” and U.S. patent application Ser. No. 12/255,621, filedOct. 21, 2008, “System and Method For Attack And Malware Prevention.”

In an embodiment, a device's state may be sent to server 629 so that ithas the most updated security information about the device. Thissecurity state information may also include the device's identifier,configuration, settings, information on recent security events, as wellas the device's state. As shown in FIG. 9, mobile communications device627 may send this security data to server 629 over the network (step631). In step 633, server 629 may acknowledge receipt of the securitydata from device 627.

In an embodiment, the local security component on the mobile device canidentify security events by analyzing files or data stored on thedevice, messages such as function or system calls between components onthe device, or network data flowing into or out of the device forsecurity events. The security events can include finding possiblethreats such as exploits, suspicious network traffic, viruses, malware,SMS message or phone call spam, suspicious system or function calls,authentication failures, etc. For example, virus detection can beperformed using a list of virus signatures. The local security component105 can examine the contents of the mobile device memory and comparethose files against a database of known virus “signatures.” In otherembodiments, the local security component 105 may also utilize analgorithm that performs virus detection based on common virus behaviorsor common virus characteristics. This alternative virus detection hasthe ability to detect viruses that do not have known virus signatures.Additional details regarding alternative attack and malware preventsystems are disclosed in U.S. patent application Ser. No. 12/255,621,filed Oct. 21, 2008, “System And Method For Attack And MalwarePrevention.”

In addition to the detection of viruses, the local security component105 can also detect security threats facing the device over variousnetwork interfaces. In an embodiment, the local security component cananalyze network data using any combination of a “known bad” network datadetection component, a “known good” protocol content and statefulnessanalysis component, and a decision component. Upon examining the networkdata, the local security component 105 may identify security eventsincluding: a protocol length mismatch, a protocol value violation, avalue violation for a protocol in a given state, a protocol statetransition violation, a firewall rule violation, a known bad piece ofnetwork data, or a piece of network data decided to be bad. Once asecurity event has been identified and associated with incoming oroutgoing data, the local security component 105 can determine how toprotect the mobile device.

Table 1 below is a listing of some possible events that can be detectedby analyzing the files or data stored on the device, function or systemcalls, or network data and example associated severity levels. Theseverity level can vary depending both on the event type and theparameters associated with an event. For example, regarding an eventcorresponding to a virus scan, if no viruses are found, the event wouldhave a low severity. If a virus was found, but it was quarantined, theseverity would be slightly higher. If a virus was found, but it couldnot be quarantined, the severity level would be high.

TABLE 1 DETECTED EVENT SEVERITY (MAX. 5) Virus scan (1 virus found, 0viruses quarantined) 5 Known bad data 4 Virus scan (1 virus found, 1virus quarantined) 3 Decidedly bad data 3 Virus found and quarantined 3Protocol length mismatch 3 Protocol value violation while in specificstate 3 Protocol value violation 3 Protocol state violation 2 Localauthentication failure 2 Spam blocked 1 Firewall rule violation 1 Virusscan (No viruses found) 0

The local security component 105 sends the security event information tothe information gathering component 107 that quantifies the securityevents and the severity of the security events. For example, theinformation gathering component 107 processes the detected securityevents and produces security state assessment results for the mobiledevice 101. In an embodiment, the security state assessment includes anoverall security condition of the mobile device. The security stateassessment is also displayed as a graphical representation of the numberof security events detected, a chart illustrating the rate of securityevents detected by the local security component 105 and other visualrepresentations of security related status information. In anembodiment, the overall security assessment condition of the mobiledevice can range from “Everything is OK” when no severe security eventsare detected to “Infected”, when a virus is detected on the mobiledevice. Other overall security assessment conditions include“Compromised”, when the local security component detects that an exploitor other attack has been successful on the device or the trust model hasbeen otherwise compromised, “Warning”, where the local securitycomponent 105 is not configured for optimal security or other useraction is desired, and “Error”, where there are problems with thesecurity of the mobile device that need to be fixed.

The security status information includes an overall mobile devicesecurity state as well as additional information about specific detectedsecurity events. The security event information is presented in variousforms including: charts, graphs, graphical displays and text. Thesecurity event information presentation may vary depending upon thedisplay on the mobile device on the client computer. The security statusdata displayed on the mobile device itself can be in a substantiallydifferent format than similar information about the mobile devicedisplayed on the client computer, website or e-mail.

In an embodiment, when data is sent or received by the RF transceiver115, aspects of the data are analyzed by the local security component105 to determine if the data should be identified as a security eventand if actions should be taken. As noted above, the assessment mayinvolve one or more possible security analysis components, including aknown bad analysis component, a known good analysis component, and adecision component. The local security component 105 stores andprocesses the data concerning security events and determines an overalldevice-wide security state assessment. The security component 105 alsoforwards the individual and cumulative security event information to theinformation gathering component 107 for further processing and producinggraphical representations of the device-wide security state. Thesecurity state of the mobile device is displayed in the form of agraphical security status icon, security event charts and various otheroutputs that communicate security information about the mobile device101. The graphical data is then sent to the transport component 109which forwards the security state assessment data to a visual display onthe mobile device. In another embodiment, the mobile device securityinformation is transmitted to a server(s) and a client computer(s) fordisplay on a device remote from the mobile device.

The processing of data such as files or data stored on the device,function or system calls, or network data, by the mobile device 101 isillustrated in more detail with reference to FIG. 2. The data isreceived by the local security component 211. The local securitycomponent analyzes aspects of the data to determine if a security eventis detected 213. If no security events are detected, the data isdetermined to be safe and is processed normally by the mobile device215. In the preferred embodiment, the screened safe data will passthrough the local security component in a transparent manner.

If the local security component onboard the mobile device detects asecurity problem with the data, one or more security events may betriggered. The local security component automatically performs defensiveactions to protect the mobile device 101 from the immediate threat. Theevent or events generated will be processed 217 in order to determine iffurther actions need to be taken. The type of defensive processingperformed by the local security component depends upon the context andtype of data being analyzed. For example, the system can drop networkdata considered to be harmful or may disconnect one or more protocolconnections associated with the data. The security component produces anevent log that is stored and updated as new events are detected.Although monitoring of the security events is primarily directed towardsdata, hardware defects may also create security events. For example,physical damage, dead batteries or other defective hardware in themobile device can cause the security component to detect a securityevent.

In an embodiment, the local security component analyzes the cumulativesecurity events and the non-security event data to determine an overallsecurity status for the mobile device 219. This security assessment isbased upon the type, severity and quantity of the security events, theirassociated data, and the non-security events and data that are receivedand processed by the mobile device 101. The information gatheringcomponent further processes the security and non-security event data bycreating various graphical and text based outputs for the securityrelated information. The data processed by the information gatheringcomponent is sent to the transport component which controls how andwhere the security status will be displayed. The transport componentdisplays the determined security status on the mobile device 221.

In addition to displaying the security status on the mobile device, thesecurity status as well as events and event data can be forwarded to aserver 111. The server may further process the events, event data, andsecurity status information and/or output the status information toother electronic devices. A security status signal can be transmitted toa client computer 233 associated with the mobile device 101 through asecurity widget. In an embodiment, the widget may provide a perpetualdisplay such as text or an icon that provides a graphical indication ofthe security status of the mobile device on the desktop or an operatingsystem tool bar of the client computer. The security status informationcan also be output to a web site or database configured to providecontent for a web site 235 for access through a web browser. The server111 also sends e-mails 237 to an electronic address with security statusupdates and/or event summaries for the mobile device(s) being monitored.The system may require user authentication procedures before allowingremote access to the mobile device security information.

In an embodiment, the mobile device 101 also downloads updated securityevent information as well as other software and database updates fromthe server 121. If the mobile device and the client computer are coupledto the same network, it may be possible for the mobile device totransmit the security state information directly to the client computer,allowing the security assessment information to be displayed on theclient computer.

With reference to FIG. 3, an alternative configuration of the mobiledevice security system is illustrated. The mobile device 101 is coupledto a server 111 and the server 111 is coupled to a client computer 233by the network 121. In this embodiment, the server 111 can include aremote security component 125, a remote information gathering component127 and a remote transport component 129. The server can also contain adatabase 131 of security event information including: virus, malware,and network-based attack, and other security threat identificationinformation. The mobile device 101 analyzes files or data storedlocally, function or system calls, and/or network data; identifiessecurity events; and forwards data concerning the events to the server111 for processing. Like the local security component described above,the remote security component 125 processes the data concerning thesecurity events to assess a security state of the mobile device. In thisembodiment, the server 111 can receive raw data or data that has beenpartially or fully processed by the mobile device 101.

The remote security component 125 might also receive data concerningnon-security events to determine an overall security status for themobile device. In an embodiment, the server 111 can transmit thesecurity status and the security event data back to the mobile device101 for display. The server 111 can also transmit the security data to aremote client computer 233 through a client computer widget, a web site235 or via e-mail 237. The security event information can include theoverall security assessment and specific security events detected whichare displayed on graphical user interfaces.

With reference to FIG. 4, a flow chart of the mobile device with serverembodiment of the present invention is illustrated. The mobile device101 receives data 311 such as files or data stored locally, function orsystem calls, and/or network data from an internal or external source.The data is then analyzed by the security component for security events313. If a security event is not detected by the local securitycomponent, the mobile device 101 processes the data normally 315. If asecurity event is detected, the event and its associated data isforwarded to the server 111 for processing 325 by the remote securitycomponent which performs many of the same function as the local securitycomponent in the mobile device 101 described above.

The remote security component will process the security event data in amanner corresponding to the type of security event detected in order toextract more information from the events and determine an accurateassessment of the security state of the device. For example, thesecurity component on the mobile device 101 may have identified incomingnetwork data as having a length mismatch. The security event is sent tothe server 111 which may have information that identifies this specificlength mismatch as a very dangerous attack attempting to exploit arecently discovered vulnerability in the mobile device's software. Suchan event may be given very high severity to alert the user oradministrator responsible for the device 101 about the attack. Inanother example, a mobile device 101 may run an executable file that isnot considered to be a virus by the local security component. The device101 sends an event corresponding to the execution of the file to theserver 111 and the server 111 having more comprehensive virus signatureinformation, may identify the file as a virus and determine the event tobe severe. Automatic or manual defensive intervention can be performedto remove the infection. Various other processing can be performed formalware and other types of security events.

The remote security component may receive information about bothsecurity event and non-security-event data received by the mobiledevice. Based upon this cumulative data, the remote security componentcan determine an overall security status or assessment for the mobiledevice 327. If it the server 111 were to determine that the securitycomponent on the mobile device 101 was unable to stop any sort ofsecurity attack or virus/malware infection, the server 111 would updatethe device's security status accordingly. If needed, the server 111 maytransmit commands to the device to remediate one or more securityproblems associated with events 317. These commands may be specializedfor the particular virus or other security threat identified by theprocessing of one or more security events. The information gatheringcomponent can process the event information to produce charts, graphs,text outputs and graphical representations for the security state forthe mobile device 101. The information gathering component at the servermay also produce a log of security events for the mobile device. Atransport component can then output the security event information tothe mobile device 101 for persistently displaying the overall securitystatus 321. The security event information can also be output by theserver 111 to client computers 233 through a direct communication with awidget installed on the client computer 233. The widget will display thesecurity status of the mobile device 101 on the client computer 233.Alternatively, the server 111 can post the status information for themobile device 101 to a web site 235, which is accessible to clientcomputers 235. The server 111 can also transmit the status informationby e-mail to an address 237 associated with the mobile device.

As discussed, the processing of the security events can be performed bythe local security component or a remote security component on a server.Because both modes of operation are automated, the functionality of bothmodes can appear identical to the user of the mobile device. Afunctional difference between the two modes of operation can be theupdating of virus or other attack signatures. In order for the localsecurity component to specifically identify current viruses and attacks,the signatures must be updated regularly. The mobile device can beconfigured to obtain updates automatically or manually. In contrast, thesecurity event database on the remote server is maintained by theservice provider and will always have the most current updates. Anotherdifference is that the communications between the server and mobiledevice may not be persistent. While the server will normally be able totransmit and receive information persistently, the mobile device can beout of service periodically. The mobile device may not be in a goodservice area, the battery may be dead or the mobile device is turnedoff. There are various other reasons that the mobile device temporarilymay not be able to transmit and receive data. Since communications maynot be persistent, the security status information may need to betransmitted from the server to the mobile device in a store and forwardmanner. More specifically, the server may determine the mobile devicesecurity state and this information may need to be stored on the serveruntil the mobile device is ready to receive data again.

With reference to FIG. 5, mobile devices often have a home screen 401that displays important information the user may want to see at-a-glanceand is typically the default screen that a user can easily navigate to.Common information on such a screen includes the number of unread emails411, the number of unread SMS messages 413, the number of missed calls415, a calendar 417 with upcoming appointments, contacts 423, thecurrent date 421 and time 419, and other frequently needed information.A home screen 401 may also be called a “today screen,” a “desktop,” orother term. In an embodiment, a portion of the home screen displayssecurity-related information. The security-related information containsan icon 405 which graphically represents the current security status ofthe device and text which may contain the security state of the deviceor other information such as settings that need attention, the number ofrecent events 425, a description of a recent severe event, or actionsthat the user needs to perform in order to keep the device secure.

The icon 405 can be displayed in a dynamic manner that includes in theimage an indication of the overall security status of the mobile device.For example, the color of the icon 405 can be a visual representation ofthe current security status. In an embodiment, a green icon may indicatethat “everything is OK”, a yellow icon may indicate a potential problemand a red icon may indicate that the device's security needs immediateattention. By activating the portion of the home screen displayingsecurity information 405, 425, the user may be taken to an interfacewhere they can perform needed actions or where they can view additionalsecurity-related information. This security screen allows the user toverify that their protection is working and immediately be notice ifthere are any security issues that may need attention. Because the homescreen 401 is very often displayed, security information is pushed tothe user in a perpetual display without the user having to request it.Such an embodiment may increase the user's attention to security andability to react to security issues quickly.

With reference to FIG. 6, an exemplary security screen 301 for a mobiledevice is illustrated. As discussed above, the security eventinformation is communicated from the local or remote security componentto the mobile device display. The status of the mobile device canrepresent an assessment of the overall security condition of the device.In this example, the status of the mobile device indicates that“Everything is OK” 351. This status can also be indicated by a statusicon 357 which can be color coded as described above. If the device isin a non-secure state, the status would indicate that the device is“Infected with a virus” if there had been an un-remediated virus eventor “Compromised” if there had been a successful exploitation. If theuser had, for example, turned anti-virus protection off, the statuswould indicate a warning that the user needs to “Check settings”. Ifthere had been an internal error, the status would indicate “Error”.

In an embodiment, the GUI includes an icon 353 located next to the textwhich also represents the overall status of the mobile device. Theoverall security status of the mobile device can be indicated by a coloror type of icon 353 displayed. As discussed above, a green icon mayindicate that everything is OK, a yellow icon may indicate a potentialproblem and a red icon may indicate a high severity security event.Similarly, the type of icon can indicate the status, such as a checkmark indicating that everything is OK, a question mark may indicate apotential problem or an exclamation point indicating a known securityproblem. By activating the portion of the display surrounding the icon353, a corresponding action screen can be displayed. For example,activating the portion of the display surrounding the icon 353 can causethe system to display details about the security settings of the mobiledevice.

In addition to the display of an overall security status for the mobiledevice, various other mobile device security data can be displayed onthe GUI of the mobile device. In an embodiment, the informationgathering component can also produce a security event chart 355 that isa graphical representation of the data being analyzed by the mobiledevice. The color of the graph may indicate the current security stateof the device. For example, if the device is in a secure state, thegraph would be green. If the device is in a warning state, the graphwould be yellow. If the device is in an insecure state, the graph wouldbe red. In an embodiment, the vertical axis of the chart 355 mayrepresent the number of analysis actions performed by the mobile deviceand the horizontal axis may represent time. In this example, the graphscrolls left with the most recent data plotted on the right side and theolder data on the left side. After a period of time has elapsed, thedata is removed from the screen. The graph can be updated at regulartime intervals such as every second. The vertical scale can be scaledfor the largest number of detected events per time period. In analternative embodiment, the chart 355 can represent the number ofsecurity events that have been detected over a given period of time.

Additional security information that can be displayed on the mobiledevice display includes: the total number of security events detected ina time period, the last time the mobile device has connected to orsynchronized with a server, and the last time the mobile device wasscanned for viruses, malware, and other security threats. In thisexample, 31 security events have been processed by the security system361, the mobile device data was synchronized 20 minutes ago 363, and themobile device was scanned 20 minutes ago 365. In an embodiment, clickingon any of these text displays will cause a corresponding action screento be displayed.

The mobile device GUI can also include user controls that provideadditional information to the users. By clicking on the “view” 371control, the screen will display more information about the detectedsecurity events. Clicking the “sync now” 373 control causes the mobiledevice to synchronize the mobile device data stored locally with aremote back up copy of the data stored on the server. The “scan now” 375control will allow the user to initiate a security scan of the mobiledevice. The system may also have controls that enable the user to set adesired format and layout for the security information output on thevisual display 115.

While many of the controls are directly accessible from the main screen,the user may be able to access additional security controls by selectingthe “menu” button 331. This can cause a pull down window of additionalcontrols to be displayed. The pull down displays can include controlsand information such as: view events, synchronize now, scan now,settings, about and exit. By clicking on the setting button, anotherpull down menu that lists system controls settings can be displayed. Theuser can then select the system controls and make any desiredadjustments.

Many of the controls, such as scan and synchronize, can be performedautomatically at time intervals set by the user, or at default timeintervals. In an embodiment, the user can select the time interval andthe time of day for performing these tasks. If a longer time period forsoftware updates is selected such as once a week, the user can selectthe day of the week to perform this system maintenance. In anembodiment, the system also allows the user to select the communicationsmode preferences for the system maintenance such as only using a localarea network or only using cellular networks while not roaming. Similarpreference controls may be available for the other system controls. Forexample, the synchronization settings may allow the user to select thetype of data to synchronize including: contacts, pictures, documents,call history, SMS messages, audio files and video files. The attackprotection settings can allow the user to select the data paths that areprotected including: cellular networks, Wi-Fi or other networks,Bluetooth, and short message service (SMS). The anti-spam settings caninclude blocking SMS and call spam based on pre-set or configurablecriteria.

As described above, the mobile device and remote server can also be indirect or indirect communication with a remote client computer. In anembodiment, a widget can be installed on the client computer that allowsthe mobile device security status to be automatically transmitted fromthe server to the client computer and displayed in a persistent manner.The user or administrator responsible for a device or group of devicesneeds to enter authentication information to allow the widget to connectto the server and retrieve information. In this embodiment, the widgetcan persistently display status and security information correspondingto a device or group of devices in a manner similar to the persistentindicator displayed on the mobile device. For example, if anadministrator's widget is configured to represent a group of devices,when all of the devices are in good security states, the widget willdisplay that all of the devices are secure. In the secure state, thewidget may display informational statistics such as the number of itemsbacked up or the number of security events processed for the group. Ifthe one or more devices are in a compromised or other insecure state,the widget will prominently display the devices that need attention tothe administrator. If the widget indicates that one or more devices needattention, the administrator may click on portions of the widget toaccess additional security information pertaining to any of the devicesthat need attention.

In an embodiment, the security status widget corresponding to a singledevice or group of devices displays device information such as batterylevel, number of security events, recent data backed up, or otherrelevant data. The persistent indicator may also be embodied on anoperating system tool bar as an icon representing the security state ofa device or group of devices. As discussed above with reference to thesecurity status icon in FIG. 5, the icon can have a dynamic aspect inthat the color or display of the icon can be an indication of theoverall security state of the mobile device. A green icon may indicatethat everything is OK, a yellow icon may indicate a potential problemand a red icon may indicate a high severity security event. In anembodiment the type of icon can also indicate the status. For example, acheck mark indicating that everything is OK or an exclamation pointindicating a problem. The user can click on the icon to accessadditional security information for the mobile device. For example, thesystem can also provide a screen that displays other security eventinformation for the mobile device in a graphical or text formats.

Additional security information can also be accessible through a webinterface that can provide security information for a mobile device orgroup of mobile devices. In this embodiment, an administratorresponsible for a device or group of devices can access the securitystatus for one or more mobile devices on a single web interface. Forexample, an organization or family may have members who each have one ormore mobile devices. In order to monitor the security status of alldevices, the transport components on each of the mobile devices can beconfigured to transmit status and security information to a server. Theserver then processes the security information and displays the securitystatus for each of the mobile devices on an administrator's computerthat is in communication with the server. By displaying the securitystatus of all mobile devices in the group, the administrator can quicklyidentify a device or devices that need attention.

In an embodiment, the administrator's computer is configured to remotelycontrol each of the mobile devices. If a mobile device is deemed to bein a compromised, infected, or other bad security state, theadministrator or user responsible will be informed and can takedefensive actions to fix or investigate the device in order to protectother mobile devices, protect the data stored on the mobile device, andinvestigate the source of any attacks. For example, if a destructivevirus is detected on a mobile device, the administrator can transmit acommand to lockdown or reset the infected mobile device to prevent thevirus from spreading. In an embodiment, the server may be configured toautomatically take certain actions upon certain security informationbeing received from the device. Additional details of the remote controlof the mobile devices are disclosed in U.S. patent application Ser. No.12/372,719, filed Feb. 17, 2009, “System And Method For RemotelySecuring Or Recovering A Mobile Device.”

In other embodiments, a user can check the security status of one ormore mobile devices through a security status web site. In order toaccess the web based status information for the mobile device, the userwill log onto a web site by providing security information to verifyaccess authorization. Security information can include identificationand password protection or various other security screening methods.With reference to FIG. 7, an exemplary web based mobile deviceinformation page displayed on a client computer display is illustrated.Since there is typically more room on the client computer display thanthe mobile device display, the system can display additionalinformation. In this example, the identification 503 and status text 505and status icon 509 for the mobile device are provided on an uppercenter portion of the display and a listing of system controls 507 areplaced in another area. Many of these controls are the same as thecontrols on the mobile device described, however these controls allowthe client computer to remotely control the operation of the mobiledevice.

The web based display can also include additional security informationabout the mobile device such as backed-up data, software updates, andsecurity events processed during the past few days 511. If any eventsmerit user attention, those events may be specifically identified on thenews feed 511. For example, if a device detected a virus or was found tobe compromised by an attack, those events would be identified on thehome screen. The display may identify the security status of each areaof the security system including Anti-Virus, Data Protection, AttackProtection and Anti-Spam 513. The display may also include a graphicalrepresentation of the security events over the last day, week and month515. In this example, the described display information is available onthe “Home” tab 519. Various other control tabs can be available such asaccount 521 and administrative 523 pages which include associatedcontrols and information. The illustrated display represents an exampleof a mobile device security status display. In an embodiment, the usercan control the appearance of the web page through preference settings.

In another embodiment, the status of the mobile device can betransmitted to a client (other than the mobile device itself) throughe-mail. An exemplary mobile device security status e-mail letter isillustrated in FIG. 8. The e-mail indicates that attack protection isdisabled for the device 611, 14 security events have been handled by thesystem 615, a virus scan has been completed with no viruses found 617,and 1 SMS message has been received by the device 619. The e-mail alsoprovides an identification of the mobile device. In this example, thephone number 621 identifies the mobile device. The quantity of databeing protected 623 is also specified. The e-mail may include a link tothe mobile device security status home page 625 which is illustrated inFIG. 6. In this embodiment, a current security status e-mail can beautomatically sent based upon the user's preferences, such as dailyand/or when a high severity security event is detected. The recipient ormobile device user may also be able to configure the informationprovided in the e-mail according to his or her personal preferences.

As critical infrastructure, mobile devices have a central role in thefunctioning of government, business, emergency response, and many othernecessary functions of a country. Cyber-terrorism attacks on mobiledevices or mobile infrastructures can result in disastrous serviceoutages and the compromise of sensitive data. This system and methodmaterially help defend mobile devices from cyber-terror attacks both bydirectly preventing attacks on devices and by allowing administratorsresponsible for mobile device deployments to recognize attacks as earlyas possible in order to put appropriate protective measures in place.Furthermore, this system and method enables administrators to quicklyinvestigate the source and damage caused by cyber-terror attacks.

One will appreciate that in the description above and throughout,numerous specific details are set forth in order to provide a thoroughunderstanding of the present invention. It will be evident, however, toone of ordinary skill in the art, that the present invention may bepracticed without these specific details. In other instances, well-knownstructures and devices are shown in block diagram form to facilitateexplanation. The description of the preferred embodiments is notintended to limit the scope of the claims appended hereto.

1. A method comprising the steps of: at a server having a securitycomponent in communication with a database containing mobile devicesecurity event information, receiving from a local security component ona mobile device raw or at least partially processed data about a firstevent that occurred on the mobile device and that was assessed by thelocal security component on the mobile device to be a first securityevent, and data about a second event that occurred on the mobile deviceand that was assessed by the local security component on the mobiledevice to be a first non-security event; processing the received data atthe server security component to assess a security state of the mobiledevice by comparing the received data to the database; based on theprocessing at the server security component, reassessing the assessmentof the second event and changing the assessment from the firstnon-security event to a second security event; and at the serversecurity component, outputting security state assessment results fordisplay, wherein the security state assessment results are based on thefirst event assessed by the mobile device to be the first securityevent, and the second event reassessed by the server to be the secondsecurity event.
 2. The method of claim 1, wherein the outputting stepfurther includes outputting the security state assessment results to aserver that outputs the results for display on a client computerdifferent from the mobile device.
 3. The method of claim 1, wherein theoutputting step further includes outputting the security stateassessment results for persistent display on the mobile device display.4. The method of claim 1, wherein the processing step further includes aseverity assessment of security events on the mobile device to determineseverity levels for the security events and wherein the outputting stepfurther includes outputting the security severity level for display. 5.The method of claim 1, wherein the outputting step further includesoutputting a list of security events for display.
 6. The method of claim1, wherein the outputting step further includes outputting a list ofsecurity events for display on a client computer different from themobile device.
 7. The method of claim 1, wherein the outputting stepfurther includes outputting a chart indicating security events on themobile device for display.
 8. The method of claim 1, wherein theoutputting step further includes outputting a chart indicating securityevents on the mobile device for display on a client computer differentfrom the mobile device.
 9. The method of claim 1, wherein the outputtingstep further includes outputting a status indicator signal representinga current security state for the mobile device for persistent display.10. The method of claim 1, wherein the outputting step further includesoutputting a status indicator signal representing a current securitystate for the mobile device for display on a client computer differentfrom the mobile device.
 11. The method of claim 1, wherein theoutputting step further includes sending an e-mail to a client computerthat includes a current security state for the mobile device.
 12. Themethod of claim 1, wherein the outputting step includes generating awebpage that includes an indication of the current security stateassessment for the mobile device.
 13. The method of claim 1 wherein thereassessing the assessment of the second event and changing theassessment from the first non-security event to a second security eventcomprises at the server, changing a first severity level assigned to thesecond event to a second severity level, different from the firstseverity level.
 14. The method of claim 13 wherein the second severitylevel includes a number.
 15. The method of claim 1 wherein the securitystate assessment results includes an overall status of the mobiledevice, and wherein the overall status includes one or more words.
 16. Asystem comprising: a server having a security component in communicationwith a database containing mobile device security event information; theserver receiving from a local security component on a mobile device rawor partially processed data about a first event that occurred on themobile device and that was assessed by the local security component tobe a first security event, data about a second event that occurred onthe mobile device and that was assessed by the local security componenton the mobile device to be a non-security event, and data about thecurrent configuration of the mobile device; processing the received databy the server security component to assess a security state of themobile device by comparing the received data to the database andaccounting for the data concerning the current configuration of themobile device; based upon the processing at the server securitycomponent, reassessing the assessment of the second event and changingthe assessment from the first non-security event to a second securityevent; and, outputting by the server security component security stateassessment results for the mobile device for display, wherein thesecurity state assessment results are based on the first event assessedby the local security component to be the first security event and thesecond event reassessed by the server security component to be thesecond security event.
 17. The system of claim 16, wherein the securitystate assessment output by the server security component is for displayon a client computer different from the mobile device.
 18. The system ofclaim 16, wherein the security state assessment output by the serversecurity component is for persistent display on the mobile devicedisplay home screen.
 19. The system of claim 16, wherein the serversecurity component further assesses security events on the mobile deviceto determine severity levels for the security events, and the securitystate assessment results output by the server security componentincludes the security severity level for display on the mobile devicedisplay.
 20. The system of claim 16, wherein the server securitycomponent further produces a list of security events and the serversecurity component further outputs the list of security events fordisplay on the mobile device display.
 21. The system of claim 16,wherein the server security component further produces a list ofsecurity events and the server security component outputs the list ofsecurity events to a client computer for display on the client computer.22. The system of claim 16, wherein the server security componentfurther outputs a chart indicating security events on the mobile devicefor display on the mobile device display.
 23. The system of claim 16,wherein the server security component further outputs a chart to aclient computer indicating security events on the mobile device fordisplay on the client computer.
 24. The system of claim 16, wherein theserver security component further outputs a status indicator signalrepresenting a current security state for the mobile device forpersistent display of the status indicator signal on the mobile devicedisplay home screen.
 25. The system of claim 16, wherein the serversecurity component further outputs a status indicator signal to a clientcomputer representing a current security state for the mobile device fordisplay on the client computer.
 26. The system of claim 16, wherein theserver security component further outputs an e-mail to a client computerthat includes a current security state assessment for the mobile device.27. The system of claim 16, wherein the server security componentfurther generates a webpage that includes an indication of the currentsecurity state assessment for the mobile device.
 28. A method comprisingthe steps of: at a server security component running on a server,receiving from a client security component running on a mobile deviceraw or at least partially processed data about a first security eventidentified by the client security component, and raw or at leastpartially processed data about a second event that occurred on themobile device and that was assessed by the client security component tobe a non-security event; at the server security component, receivingdata concerning a current configuration of the mobile device; at theserver security component, processing the received security event dataand the received current mobile device configuration data against adatabase of security events including at least three of the securityevents in the group of security events consisting of exploits,suspicious network traffic, viruses, malware, SMS message spam, phonecall spam, suspicious system calls, suspicious function calls andauthentication failures, to assess whether the security event representsa present threat to the mobile device on which the event occurred; basedupon the processing at the server security component, reassessing theassessment of the second event and changing the assessment from thefirst non-security event to a second security event; and, at the serversecurity component, outputting a mobile-device-specific security stateassessment for display, wherein the security state assessment resultsare based on the first event assessed by the client security componentto be the first security event and the second event reassessed by theserver security component to be the second security event.
 29. A methodcomprising the steps of: at a server security component running on aserver, receiving from a client security component running on a mobiledevice raw or at least partially processed data about a networkinterface event identified by the client security component; at theserver security component, receiving data concerning a currentconfiguration of the mobile device; at the server security component,processing the received network interface event data and the receivedcurrent mobile device configuration data against a database of networkinterface events to assess whether the network interface eventrepresents a present threat to the mobile device on which the eventoccurred; and at the server security component, outputting amobile-device-specific security state assessment for display based uponthe server processing.